Subject: Re: ipnat rules for firewall
To: None <psapprich@mindspring.com>
From: Laine Stump <lainestump@rcn.com>
List: netbsd-help
Date: 07/16/2000 22:11:15
(Followup redirected to netbsd-help@netbsd.org)
At 08:57 PM 7/16/00 -0400, psapprich@mindspring.com wrote:
> There seems to be some problems with the firewall rules. I had even
> tried 'pass in all / pass out all', the LED's on the cable modem flash in
> sync with the browser clicks on the station on the local network, but no
> packets seem to be coming back.
Are you watching the output of "ipmon" to see if packets are being rejected?
This works for me (tlp1 is external interface, tlp0 is internal):
pass in quick on tlp0 from any to any
pass out quick on tlp0 from any to any
pass in quick on tlp1 from any to any
pass out quick on tlp1 from any to any
Beyond that, set ipnat.conf to something like this (this one assumes you
want your internal network to be 10.0.0.0/24, and tlp1 is the external
interface):
map tlp1 10.0.20.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
map tlp1 10.0.20.0/24 -> 0.0.0.0/32 proxy port 7070 raudio/tcp
map tlp1 10.0.20.0/24 -> 0.0.0.0/32 portmap tcp/udp 10000:65000
map tlp1 10.0.20.0/24 -> 0.0.0.0/32
Once you have it working like that, you can start adding more stuff to
ipf.conf (don't want to leave it wide open like that!).